Source: "Politika"
Of approximately one hundred thousand of those who are required to register only a few dozen have applied for registration, says the Commissioner Rodoljub Sabic
There are almost no people who have not experienced receiving at their home address or private telephone number information that specific company wants them for a client, that they should buy a product or participate in the promotion of various products and offerings. And these are neither flyers that are inserted into mailboxes, nor random calls, the mail is addressed to the name and surname, and with calls the owner of the phone is asked for by mentioning his name.
The companies we have contacted, and which conduct the so-called "direct marketing" claim that all their activities are in accordance with the Law on Personal Data Protection, that they find the addresses and phone numbers in official databases, such as "White pages" or they receive them from the clients themselves with their consent.
A significant contribution to efforts to regulate the disposal of personal data for this and similar purposes has been given by Rodoljub Sabic, Commissioner for Information of Public Interest and Personal Data Protection, by establishing and publishing of the Central Register where all those who are making personal data collections, for whatever reason, are obliged to register. However, the deadline for registration in the Central Register, where personal data collections should be registered, has expired back in November 2009, but from about one hundred thousand entities who are required to register, only a few dozen and only one Ministry has done so.
Small businesses, large enterprises, banks, insurance companies and state agencies can have personal data collections, and all are required to be listed in the Register that is established at the Internet site of the Commissioner for Information of Public Importance. The purpose of the Central Register is recording of all personal data collections and it provides a possibility for everyone to find out who is processing data, for which purpose and where they are available.
According to Sabic, the largest personal data collections are the ones of the Health Insurance Bureau and of the Ministry of Internal Affairs. Then there are those of the Pension and Disability Insurance Bureau, Tax Administration and the Ministry of State Administration, and some state-owned enterprises like Telekom or Elektrodistribucija, some banks and insurance companies also have large collections.
Sabic highlights that the fact that the authorities have not fulfilled the obligation of registration in the Register, although the threatened penalties range up to one million dinars, is particularly worrying. ‘’Anyone who keeps any records containing personal data of citizens has to be entered in the register, and the most important thing’’, says Sabic, ‘’is that the major state institutions should do this’’.
‘’ In most cases non-fulfillment of these obligations is the result of the lack of information and misunderstanding of the contents of the new law and so far non-existent obligations. The government has delayed the adoption of a regulation that is supposed to explain how to fulfill these obligations. That's why I did not and will not launch the infringement procedure as yet’’ says Sabic for "Politika", noting that if something important is not changed, he will start launching infringement proceedings before the end of the year and first against irresponsible authorities.
Personal data of citizens in Serbia can be accessed by those who have the approval of personal data owners, or by those that are expressly authorized by law to do so. According to the Commissioner, the data are adequately protected only in case when they cannot come into possession of a third party and if they are not used for other purposes other than those for which there is consent or legal authorization.
‘’Although our Law on Personal Data Protection provides for special protection of sensitive data such as ethnicity, religion, health, etc., such protection does not exist, because the government has not yet determined the appropriate decree. The deadline for the adoption of the decree expired more than a year ago, but despite my warning it has not been adopted yet’’ Sabic has pointed out.
Citizens have a right to be informed about the processing of their data and the right to review the data, and they can also request correction, update, or deletion and also the cessation of processing, if the legal requirements have been met.
‘’This is a personal right of every citizen and entails personal involvement. Thus, information about the data is not received automatically. Those interested should communicate with the institution holding the data, and if they have a problem to exercise their right they can contact the Commissioner’’ explains
Rodoljub Sabic. He adds that this right can be limited in situations where giving notice would seriously jeopardize public interests and national security, or actions of prevention and prosecution related to criminal offenses.